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(57) Abstract 

In an interactive broadcast system, signals transmitted by a service provider (30) are passed via a gateway (12) to a subscriber terminal 
(2). In order to gain access to services, the subscriber terminal (2) transmits an authorization request message via the gateway (12) to 
the RADIUS server (18). This RADIUS server (18) transmits in response to the authorization request message an authorization challenge 
message to the subscriber terminal (2). In return the subscriber terminal responds to the challenge message with a challenge response. This 
challenge response is checked by the RADIUS server (18) and, if correct, the RADIUS server (18) transmits a message to the gateway to 
give the subscriber terminal access to the service. 
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Broadcast network with interactive services. 



The present invention relates to a broadcast network comprising an information 
server coupled to a plurality of subscriber stations for transmitting broadcast signals to the 
subscriber stations, the broadcast network further comprises a return channel for transmitting 
information from the subscriber terminal to an head-end, the broadcast network further 
5 comprises authentication means for authorizing the access of the subscriber terminal to 
interactive services 

The present invention also relates to a subscriber terminal, a gateway and a 

method. 

A broadcast network according to the preamble is known from ETS.300802, 
10 Digital Video Broadcasting (DVB); Network independent protocols for DVB interactive 
services, EBU/CENELEC/ETSI-JTC, November 1997. 

Presently, interactive services are introduced in several types of broadcast 
networks, such as DVB-Satellite, DVB-Cable and DVB-Terrestrial. For enabling these 
interactive services, a return channel has introduced in order to transmit information from a 
h5~ — subscriber terminal to a head-end. The information server ean4>e^resent-HVthe-head end, but it 
may also a remotd ^ervferAvhich Bdonnectdd to the »h<&a-end. The subscriber terminal can e.g. 
t w„ fc e £ stl tQ p y ox a -cable* nftodem. The returwchahnel caw te a ^rinection ^via the Public j 
'Switched telephone Netwdrk, via a Cable return channel or even a satellite return>channel. [ 
:v An operatbjj;:#f the information server r^uire^eliable authentication, r; \ 
20 authorization and subsequent, billing of users using tfre inforrnation server, Ifl "present systeqis 
' this authorization is done using thfe Point to Point Protocol (PPP) which is described in RFC 
' j;l§<51 and RFC 1994. PPP is pot suitable for providing'for authentication and ^thcfrizati^n for 
v. , * Idifferent- services, because EPP only provides for autymicatipn and authorization of a 
"commuirtication link. -v-f '"■••» 1 

; .« ' . . *'*: I«* S.< ' ' 

— 3 ' : / > i jin 3i.- -/>.::*^ •»>' !'.. 

...iw' f p . v o*v" ' -'r • '- 

.-t,"u*i '*. r.'.A^v 'Wu\:y A £ t ■' 

'fii*v,.~ ' r si* .v .: • 

The object- of the present invention is taprovide a broadcast network according 
to the preamble in which authorization and authentteAtibn for; multiple services is possible. 
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To achieve said objective, *he broadcast network apcording to the present invention is 
characterized in that the subscriber terminal comprises authorization transmitting means for 
transmittihg^aothorization request .messages to an authorization server, the authorization server 
being arranged for checking the entitlement of the subscriber to services to be provided by the 
5 '- information server, and in?. thaUhe : authorization server is arranged for enabling the subscriber 
to access said services. . . ;v. 

v 7 j * ; u :By introducing the^autto^ means in the subscriber terminal 

and adding authorization sefver,to which, request messages can be sent. The authentication 
server then requests an authentication message from the subscriber terminal. After the identity 
10 of the subscriber and the entitlement to the requested service has been verified, the 

authorization server enables the use of said services by said subscriber terminal. The above 
process can be canied out. for each differen t. service. 

r: > ' - ' : /> ;it is bbservedjhat |iuRBC ?138 the so-called radius protocol is disclosed. In this 
protocol, the authorization transmitting means are not included in the subscriber terminal, but 
15 7 'they are present in* the server to which a subscriber logs on for accessing the service. 
7i-; 4 f o:icy*t . r r ..fAn^embodimenCpf the present inventions characterized in that that the 
1 v information server is coupled to.the subscriber teryninals via a gateway, and in that the 
n " authonzatibn server is arranged for enabling the subscriber to access said services by 
transmitting a-hfessage to the^teway tt^grant said, subscriber access to said services. 
20 > '^ T --Au-d^y'Way)[<|fienablingfaccess.toj^e services is to sent a command message to 

a gateway informing ihe gateway that certain services for the authorized subscriber stations 
v : h&Wlo be passed. This gateway &an be present in the head end. 

j : < A' ftjrtfierT embodiment of the inyentio.n is characterized in that said message 
' J Comprises ihfonTiatibri^bbut atrle^st one source JP address from which IP packets are passed 
25 ; to the subscribed stationri:, - ? , : , , - . , 

r : : , suitable way to enable services is to, inform the gateway that IP packets 

" having a p^ifeuia^destination' address have to be passed to the subscriber terminal which has 
requested. In some systems it will also be needed that IP packets from the subscriber terminal 
is passed tb a'host 'With a particular destination address. This destination address may be the 
30 siamfe as the* source' address* but^this is not a necessity. 

- ' >. x ...ij 'j. j : ^xk ?■ --{■ -±; r , . ..... 

*' ' * • ' . . *. 

- * . The^ present iiii yention will now be explained with reference to the drawings. 
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: ' " n Fig. 1 shows a block diagram of %e 6dhimunication n eW H according to the 

invention. 

' 1 - F - g>2 shows a protocol 

"j ':•?:•>•< .■ ■J--''. - '.ism u.'J */K;.!-.-:f> c,: ,•*»■• . . tic ' 

the invention. " i . 

£ - ^g?3 show a flow diagrarft of tfsUcMssful attempt of ^ubscnbfir terminal to 

access services provided by the information server 30. «vr cat I-..., , , 
-•™n.-.:r.;.:. • » •: Rg> a flo w--di 1 ^raift'bf-a5faiUng--attei n pt of a subscriber terminal to 

r " * ..* "* b. c . • •>«. • ; * ' <^ rt MhiVj ;i; . ;t ; ; .-32**; . ;>\.t r * 

••*<*• 1 - !r •••• : : • ^ 

be a set ,op box (SIB) or a c^«id»&**»«M 4**mM+&*m* 3 and 4 of a . 
' ' " s 'HybridFiberCoax neVwork to'. ^^(BhtedcasbNBWo* adapter) and to a gateway 12 £ 4 

v.; .U.&T-. ...t -^j^ <••-"•« ' --^^^ »'•••>>"••••*-• , 

A" ' : ' ' ' The rifst logicalehannel i^ari uniatecdo^broadsas^hsinel. which ts part of , m 
' a Broadcast Debvery Network S.canies vid*.; audio and4ata. The second logical channel 
' is a bi-direcuona! intention channel, whicnispto of^me^dTO^W^-lOTh.s second _ 
i 0 iic 3 ai chinnei is intended for interaction purposes** W *UW!W! interaction pa* ,^ 
i>: an'ti i forward inuKctidh path. The3foh^ta»eacttop*hJ»*Wt!f^'» 10 *« 
$5"" broadcast ^M^^-^f^******""*** '* "* ^ 

Physically, the broadcasting deliver* hetwdrklsnd J^Mta****** #d over one HFC 
Network i.e. the STB h^oniftFconheetitintettafflemewptk. 
ro«« •■ - ^^^Nefwbrk Adapte^A^liimplemen^e funcnonahtyof a 

„ Network Access Server (NAS) for al.owing the subscribefcterrmnal; 12 (STB or Cab,e Modern) 
= " r T ' to access an IP network 16 Over the HFC-network* It embeds the interactive (IP) data ,n the 
; ' ' interaction'channe. 3/tte Broadcast NetWork^da^B^M embeds tire OP) data in the 

broadcast Charinet4. : t -" ' ' . " • ... 

- - According ^to the preseht invention authorization servers 1.8, 20and22are 
30 connected ,o the » netwbrk .6. These au^driaation^^, ^her ,0 ^be^ ^ as 
RADIUS servers, because they operate according to the RADIUS protocol (RFC 2138). The 
subscriber terminal 2 transmits an authorization request message via the WA 12 fo one of the 
' ; RADIUS servers 18, 20 and 22i These RADIUS serventlransmi. an access challenge message 

to the subscriber terminal 2 in order to check the identity of me subscriber termmal. In 
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response to said access challenge message,. the subscriber terminal 2 transmits a second access 
request message which carries* response to the challenge message .to authenticate itself. If the 
" " ' information carried by the second access request message is regarded as correct, the RADIUS 
server submits configuration information to the EtfA ,(ot BN A), necessary to deliver the service 

' 5 *" to the STB in question, '■ •■■ .- . .r; ,'/...■:■:.> S; - : . • .. 

' • : • ■" n ■ Optionally; ^RADIUS server can act as a proxy client to other RADIUS 
' servers or other kinds ©f -authentication servers. This can be seen in Fig. l\ by the connection 
of further radius servers 24, 26 and 26 to the radius server 18. 

; ' 1 "'r.-;..:.'v. So: : . v>- ;. -.j i; -n-, .o.^',, ,•• • r . 

..... _ ^ 5 

10 v.'. tsdl-.T Ak-expfeunedabove, authentication, authorization and accounting is based on 

: the RAT>KJS ; pr6tb^ authentication, authorization and accounting 

within the Internet community. RADIUS supports authentication, authorization and 
accounting on a pef-sessionibasis. Furthermore different applications running in parallel are 
1 ; supported', because each application can initiate.the transmission of transmission of request 
15 " messages to¥RADOUS server,. Also different accounting policies e.g. one for web-browsing 
a*d another fof^IP-telepbonyrcan-be'suppprted, because the RADIUS server can transmit 
different configuration messages to the INA 12 and/or BNA 14. 
■ ■ >-.3£-2 m ■ Duetb the pres«nt of different RApnJS servers,, it is possible that each ISP or 
ASP does its own authentication, authorization and accounting. . r 
20 : '' : ' ' ! - • K? The architecture shall allow. STB's which doesn't contain functionality for this 
s ' krchitectuit to ehteri<erc-a^le i netw»fc. Howeye^ security measures shall be taken that they 
L " ; &t n&^ce^kaccbtiJsaWeysei^^for vdrich,tiiey.~have tote authenticated and authorized. 
d r„o r;w i 0 ^^''^^ e v^'-fe.- s ^ U rea.e.;u^-pan no,t circumvent authentication, authorization and 
' : "•• fJ ^dun^ifSi%y^naciah^'Ae STB or cable modem, because all sensitive information can 

25 ' te stored #ii a secure 'smart eard:: :W.\>, , ■■. ■ . ., - ; - , , 

The proposal is to add RADIUS functionality to the Set-Top-Box and Cable 
Modern i.e: itlobks^like'a RADIUS client is built into, the STB or CM. This can be done by 
r " ;: ; addin'g^R^IUS-Sindtibnality to the; STB and CM middle .ware. 

The STB RADIUS client present in the subscriber terminal 2, communicates 
30 with a ? R^IUS^ptoxy inside the INA 12 which on its turn communicates with the RADIUS 
server 1 8/20' of 22 of the ISP orrASP.in question.The INA 1? includes an IP filter and 
functidriaiityTd? accounting; 1 : , „; v 
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;i " The subscriber terminal 2 uses tfSmartCard, which 
• ' p^sswofd and a CHAP secrecy. At set-up of ^connection, this infprmatipn is used to 
" : ' authenticate and authorize the subscriber termini by -the RADIUS server 18, 20 or 22. 

~ ' •"• "The IN A 12 Contains a-RADIUS 'security module for securi connection 
5 with the RADIUS server. The RADIUS security module ismsedto add to each RADIUS 
messaged cryptographic message digest ofchc payload.ofethe. message, so that the RADIUS 
'server 18; 20 or 22 can verify that the message is-geherated byan authorized I^A and not 

■t. . J ..! 



■.yy.r.:').- 



tampered with. 

The data base of the RADIUS server contains for each subscriber terminal, the 
10 '' ID password and CHAP security data stored on the SmariCard. Furthermore, it contains for 
" • each ENA the RADIUS security data for authenticating^ RADIUS messages coming from 

ie'lNA'inqi^Wan'd'viceversia.- - • V't^^ > . .-•„•, 

; ; : ■'- " The RADIUS client inside the STB implements allnecessary functionality for 
^idsauthentfcation/kthoriz^Sh and accounting.* is capable of gyrating and 
"""" "l5 handling all RADIUS messages i^'. Acce§s-Request,^ Access- Ac^P 1 ' Access-Reject, Access- * 
-™ " challenge ari^ihe accounting'messagest AccountingvRequest and Accounting-Response plus * 
the necessary message attributes; ' . . ■ c vi fio>- sjs-\. .a P : 
• :1: ' : " RADIUS messages will ^ohly be exchanged: on <the Interaction Channel between 

the STB and IN A. ' " ' * : "' • ""- • ' •--:<^' 

! ; ", 0 V ' The subscriber terminal 2 kndws ita^rtfcfff of the RADIUS server, it needs , 

; ;! " : " : for authorization, authekicatiotf and ^ 

' : b ' ' 'broadcast address: 255.255.255.255 ^e^WS^^mmm^ m * 
; ! "" rt adkress of the default RADIUS seWdr^CRADBJSi^^eli^TOUp^port number 1812 
aoP,:,.oln ^ aumet ^ cai J on and i authorization and ^U.forRAD^S^cgounting.) The 

25 RADIUS message attribute: 'NAS-Port' can be u^: to address the^fferent applications 
■"' L * '"runnlngm the subscriber terminal fe> - ! : tei^o— S »T 

• 2 : • i rr < TWRADlUS'mdsage^ 

designated RADIUS server of the IP address of.tbe.RADIUS^lient preset in the subscriber 

? 'terminal V ~' : ' ' ™ =' ^ ' *T< ,,T 

; ' 3Q J " ■ Fig 2 : shows ^protocol stack ttfbe I iiOPJ^?^^^^ lrabertenn,na12 - 

r : Below the-appli^ 

placed on top of the UDPATCP layers 38 and 40. It canbe part of e.g. a MediattghWay 
adaptation layer 34. More than one application in the subscriber terminal 2 can make use of 
the RADIUS functionality, so that for each application a RADIUS session can be executed i.e. 
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authentication, authorization and accounting can be done. Below the TCP or UDP layer, the IP 
layer and the MAC layer arei present.. iti -, . 

- ... nTh,thftflowgi»ph,,a9oc>«lin| to Fig. 3, the interactions/neededtoj authenticating, 
authorizing and^accounting, .between the subscriber termjna) 2, the INA 12, the RADIUS 
server are shown. 

**• j. : t. .This sequence ; is executed aftCT a STB has successfully signed-6n, oh the MAC 

• layer in step 56.oIn: step 58 : the; subscriber terminal 2,sends a DHCP request message to the 
INA 12 in order to obtain an IP address. In step 60, the INA 12 replies by transmitting DHCP 
reply message containing, an; IP address to be used by the subscriber terminal 2. 

3 in order to access a. service,^ subscriber terminal 2 sends a RADIUS access 

request message to the INA ;1? instep 62. Instep 64 the INA 12 forwards this request message 

- to the appropriate RADIUS server e.g. ; 18. Inresponse to said RADIUS access request 
message, the RADIUS server transmits in step 66 a RADIUS challenge message to the INA 

• 12, which passes this.messagejn : step 68 to the subscriber terminal 2 to authenticate it. The 
15' ; siibscriberterminalI2replies,in step.70wim transmitting (via^ 12, step 72) a RADIUS 

' ' • access request message containing^e.RADIUS ; challenge response to the RADIUS server 18. 
sli ? <V .„ r . . : The RADIUS ;seryer lS.checks the challenge response message and if the 
r -challenge response is correct,, the RADIUS server 18 implies in step 74 with a RADIUS access 
accept message. This'RADIUS access accept message signals the INA' 12 and, in step 76, the 
20* subscriber terminal 2 thawhis subscriber terminal 2 is given access to the ; requested service. 

Before therequested service is started, the subscriber terminal 2 sends in steps 
? > 78 andWa ; RADmS'accoMnting,request message via^the INA 12 to the RADIUS server 18 in 
: ' : o&erWttim'bn the accounting for the requested service .The RADIUS server 18 will respond 

: : in : step^ by transmitting. a.RADIUS accounting response message to the INA 12. This 
25 message will adjust theIPrfilter ; 84,of the.INA 12 in such way that the TP-datagrams of the 
" requested service canhe forwarded by the INA 12 to the subscriber terminal. Furthermore, the 
• INA l!2 forwards' the RADIUS accounting response message to the subscriber terminal 2. In 
response 1 to the RADIUS accounting response message, the subscriber terminal 2 starts the 

""• service'. ■< cJ TO- >.u -/'.oil'. ' .•• : - . t . - 

30 When the requested service has finished, the subscriber terminal 2 transmits in 

steps 90 and 92 a RADIUS accounting request message to turn off accounting, via the INA 12 

to the RADIUS servfcr/li8. ^e ; RAp ) |US i J server r 18 responds to the message 92 with an 

RADIUS accounting response 94 which is transmitted to the INA 12 and which is passed as 

message 98 to the subscriber terminal. When the RADIUS accounting response is received by 
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the INA 12 from the kADIUS' server 12, the iP-*tter is adjusted insuch way that the IP 
datagrams of the service in question is blocked^heWA:: ?AM :,v 

' ' "ft Vs observed that the aba^bWy^xampi*iof.how the interaction between 
the STB, INA and RADIOS defter can be done; *My*«i^cw4je in^oduced on this 



. r . _5 sequence. 

The flowgrai* according Fi^4i S hbW S . the interactions between the 



1 r ;nr;. 



subscriber terminal 2.&IA 12 and t£*A*HG*-»*> .18 fofctha case that the subscriber 

'' n "' ,v. - ' - 7 7,>be <f; ,ic Kmc. * oj -..r.o rr " •'- 

terminal 2 is rejected: 

The steps Up to and iiicltM^7»awJ«ac^*^^i s shown in Flg " 3 ' 
' ' When the challeng^ response' 'fi^M by the subscribe* terminal is not correct, the 
^ " radius server replies with a P^ 

, INA 12 and passed* the subscriber terminal signal the B^and the subscriber 

" terminal 2 is not allowed' to access the service;-^ - ?■ • x - 

Aftersome time the to^^K^ ltaC " 
^ ' " a5 7. be : hindy for the case' mat the ^l^nission^fthe »M*M*j!tf!» meantime. For. 
^ "" " ' 'example the user Us called £a service center of m^accessrs^c^der to update ns 
Z T fissions: This related retries aft indict ™> and "While Not 

M Accepted" blocks lOo anolOCAs lohg as afccess^subs^riber te^inal 2 isnot 

" " n "" " auU K)rized The IP-filter ^ ; 
^T^rovide r 30 to the subscriber terminal 27 Als6 passing of info^atio^ from, the subscriber ■ 
terminal 2 to the information provider 30 is Worked. : wol* 
' " 7 ; Ji * With PPP.^y the PPF-pipe^^^^W^^ 1 and authonzed. 

« 33- •£« v ; v:.: .''.U'T * T .si, (,•>■• , .f.v- p PP the same formal] types, pf-sejyices i.e. it can not 
■ t , Furthermore, the accounting used in PPP is me same iuu«w aw. -f o. 

" 1 ' "support differentlccoumihg policies direc.JP architecture, *. 

' : I "^5 "au,hen. i ca U on. a u I ho ri W.io„ antfaccduhUng c*, be done on aper service basis. 

* By using'an tP-'filter &nd by doing acoauoling.ouJsjde.Ihe. ; §TB, the proposed 

" ' V ' 1 " and accounting by using an 'phony' STB. Tlte lP.fdter w.i)14:eep out data of unaurhon^d 

STB s The IP-filter »ill be conrrolled by ft. RADIUS messages from the RADIUS server ,n 



30 question. 

- "" The proved architecture can support homogeneous networks with cable 

; ' ; modems and STB's from third p^arriesrtf is 6bserved.that that the proposed architecture also 

'•" works with PPP :j - • • 
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Acronyms 
ASP 
BNA 
CM 

;CRC. 

DVS- ; 

HFC 

.INAo.- ns i _ 
IP . 
ISP 

MAC 
. RADIUS 

• RF . s 

STB 
TCP 



Access Service Provider. 
Broadcast Network Adapter. 
Cable Modem. 
. Gable Return Channel, 
i ... . fJ . , ? Digital Video Systems. 
. . JHybpd Fiber Coax. 

Interactive Network Adapter. 
. , fl Internet Protocol. 

Internet Service Provider. 

^ , & t Medium Access Control 

r Remote Authentication Dial In User Service. 
^ Radio Frequency. 
Set Top Box. 
Transfer Control Protocol 
• „ User Patagram Protocol. 



> _ . 5 : ■ 



■. r? 
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1 . Broadcast network comprising 'aft ?fif 6rmation server coupled to a plurality of 

subscriber stations for transmitting Broadcast sigrtais to the subscriber stations, the broadcast 
network further comprises a return'channeT for transmitting information from thfe subscriber 
terminal to an head-end, the broadcast netwprk L fditller comprises authentication means for 
authorizing the access of the subscriber tenhifial t& interactive services, characterized in that 
the subscriber terminal comprises authorization triftsmitting means for transmitting 
authorization request messages to an authorization server, the authorization server being 
arranged for checking the entitlement of thelubsCfiber to services to be r previded by the 
information server, and in that the authorization iferver is arranged for enabling the subscriber 
to access said services. 



2. Broadcast network accordingltb claim 1, characterized in that the information 

server is coupled to the subscriber terminals via a gateway, and in that the authorization server 
is arranged for enabling the subscriber to access said services by transmitting a message to the 
1 5 gateway to grant said subscriber access to said services. 

3 Broadcast network according to claim 2, characterized in that said message 

comprises information about at least one source IP address from which IP packets are passed 
to the subscriber station. 



20 



4 Broadcast network according to claim 2 or 3, characterized in that said services 

arc transmitted using IP packets, and in that said message comprises information about at least 
one destination IP address to which IP packets from the subscriber station are passed. 



25 5. Subscriber station for receiving broadcast signals, said subscriber stations being 

arranged for transmitting information via a return channel to a head-end, characterized in that 
the subscriber terminal comprises authorization transmitting means for transmitting 
authorization request messages to an authorization server, the subscriber further being 
arranged for receiving authorization messages from the authorization server, and in that the 
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subscriber station is arranged for requesting services from the head-end after receiving a 
positive authorization message. 

6. Gateway for passing information from an information server to at least one 

5 subscriber terminal, characterized iff that the gateway is arranged for passing authorization 

| -a- v = '•' / r- 

request messages from the subscriber ^rminal to an authorization serveivand in that the 

• ' ? * " . , ' i ■ 

gateway is arranged for enabling the subscriber to access; said services inTespbnse to an 

authorization message received from the authorization server. 

10 7. Method comprising transmitting broadcast signals to at least one subscriber 

station and transmitting information from the subscriber terminal to an head-end, method 
further comprises authorizing the access of the'subscriber terminal to Available services, 
characterized in that the method comprises transmitting authorization request messages by the 
' subscriber terminal to an authorization server, checking the entitlement of the subscriber 

15 terminal to services to be provided and in that the method comprises enabling the subscriber to 
access said services if the subscriber terminal is;fentitled. ~ — ; 



::2 



8. Method according to claim 7, characterized in that the method comprises 

transmitting information to the subscriber terminals via a gateway, and in that the method 

i . . 

20 comprises enabling the subscriber to access said services by transmitting a message to the 

-•■ • v \ i • ■ 

I gate way to ^ant said subscriber access to said services. z j 



^ r _™, : Method according to claim 8, characterized in that said message comprises 



v.- 



infoimation-!about!at:|eait one-source IP address from which IP packets are passed to the 



25 . subscriber stations — * 



I 



» - S? 



10. ; Method according to . claim>8 or 9,:characterized in that said services are 

transmitted using IP-packets, and in that said message comprises information about at least one 
destination IP address! to which IP packets from the subscriber station are passed. 
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